From 14bd44d4f8386991795abf4c311b7c3ffe63e537 Mon Sep 17 00:00:00 2001 From: Raj Nakarja Date: Tue, 3 Nov 2026 11:21:34 +0100 Subject: [PATCH] Remove the provenance attestation from releases The Cyber Resilience Act does not require it, and it has never run. Releases keep their SBOMs. --- .github/workflows/release.yml | 6 ------ README.md | 7 ------- 2 files changed, 13 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0cc90c0..3568cc7 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -6,8 +6,6 @@ on: permissions: contents: write - id-token: write - attestations: write concurrency: group: release-${{ github.ref }} @@ -78,7 +76,3 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} TAP_GITHUB_TOKEN: ${{ secrets.TAP_GITHUB_TOKEN }} AUR_KEY: ${{ secrets.AUR_KEY }} - - - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 - with: - subject-checksums: dist/checksums.txt diff --git a/README.md b/README.md index 26ada3b..39bf1fc 100644 --- a/README.md +++ b/README.md @@ -38,13 +38,6 @@ a single static binary for managing Superstack from a terminal. [releases page](https://github.com/siliconwitchery/superstack-cli/releases), unpack it, and move `superstack` onto your `PATH`. Repeat to update. -To check that a downloaded archive was built from this repository by its -release workflow, run this with the [GitHub CLI](https://cli.github.com): - -```sh -gh attestation verify --repo siliconwitchery/superstack-cli -``` - Each archive's release also carries its SBOM, `.sbom.json`. ## Local development